{"id":"CVE-2026-114133","summary":"Nuxt server islands render `useHeadSafe` input without sanitisation","details":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","aliases":["GHSA-xfq5-w38q-pc2x"],"modified":"2026-10-22T02:49:12.848992918Z","published":"2026-10-21T17:52:09.381Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114133.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114133.json"},{"type":"FIX","url":"https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2"},{"type":"ADVISORY","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114133"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nuxt/nuxt","events":[{"introduced":"74ef96d096d0045fd00fccd880c1dbbfea51e22a"},{"fixed":"026e99314c5dfddc63de6d40c977b79c85c88bf8"},{"fixed":"493565e99451a0f52330b1f6b979254a4a39e5d0"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"3.13.0"},{"fixed":"4.6.2"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"493565e99451a0f52330b1f6b979254a4a39e5d0"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v4.6.2","range":[{"fixed":"026e99314c5dfddc63de6d40c977b79c85c88bf8"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114133.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}